GDPR and data handling

Who is the controller and who is the processor

You are the controller of your contacts. You decide who goes on the list, why they are being messaged, and what the message says. Blue Reacher is the processor: we hold and transmit that data on your instructions to run the service you bought, and we do not message your contacts for our own purposes or sell, rent or share your list with anyone. For the data we hold about you as a customer, meaning your account, your billing and your use of the platform, we are the controller and the answers below are ours.

That split decides who answers what. A request about a message someone received goes to the business that sent it. A request about a Blue Reacher account goes to us. Either way, write to support@bluereacher.com and we will tell you which one you have.

What data does Blue Reacher hold?

Six categories, and nothing outside them. Each row says what it is and the reason it exists, because a category with no stated purpose is the part of a privacy page nobody can check.

Account and billing

The name, work email, phone number and company details of the people who use the account, plus the billing record for the subscription. Held so the account exists, so we can reach you, and so invoices are correct.

Contacts you upload

The names, phone numbers and record fields of the people your team messages, as they arrive from your CRM or an upload. Held because they are the addressees of the messages you asked us to send.

Message content and threads

The messages sent and received on your lines, with timestamps, delivery states and which channel carried each one. Held so your team can read the conversation, so replies post back to your CRM, and so a delivery dispute can be answered with a record.

Opt-outs and suppression

Who asked not to be contacted, the exact text that triggered it, when, and every blocked attempt afterwards. Held because it is the only thing that stops a suppressed person from being messaged again, and because it is the record a compliance review asks for.

Usage and technical logs

IP address, browser and device type, pages visited, access times and activity logs from using the platform and this site. Held for security, troubleshooting and understanding what people actually use.

Support correspondence

What you wrote to us and what we wrote back. Held so a later conversation does not start from nothing.

How is your own contacts' data handled?

Their data is yours, held on your instructions, and used for nothing else. It is not pooled with other customers, not used to train anything, not sold, and not messaged by us. Workspaces are isolated from one another, traffic is encrypted in transit, and production access is limited to the people who operate the platform. The one thing we do to a contact without being asked is stop messaging them: an opt-out is detected on the reply, honored in seconds, and applied across every line, campaign and automation on the account, including manual sends from a rep who never saw the thread.

What stays with you: the lawful basis for messaging each contact, the consent record behind it, telling your contacts what you collect and why, and answering their requests as the controller. The anti-spam and acceptable use policy sets out the list practices we expect and the programs we refuse to run, and the security page states the practices in the same words we use with reviewers.

How long is data kept?

A rule rather than one number, because the categories genuinely differ and a single figure would be wrong for most of them.

While the account is open

Contacts, message threads, delivery records and usage data stay available, because a sales team needs its own conversation history to work.

On deletion or account closure

Account data, contacts and message content are removed from live systems within 30 days of a verified request. Backups roll off on their own cycle and are never restored to bring deleted data back.

Kept on purpose after deletion

Opt-out and suppression records, in the minimum form that identifies a number as do-not-contact. Erasing them would silently re-enable messaging to the exact people who asked to be left alone, which is the opposite of what an erasure request is for.

Kept as long as law requires

Invoices, payment records and the tax documentation attached to them, for the retention period the applicable accounting and tax rules set.

What rights do you have, and how do you use them?

If you are in the EU or the UK these come from GDPR. California residents get the equivalent set under CCPA, and several other US states now match it. We apply them to everyone who asks, wherever they live, because running two standards is how the wrong one gets applied. Every one of them starts with an email to support@bluereacher.com, and we answer within 30 days.

Access

Ask what we hold about you and get it, in a form you can read.

Portability

Ask for a machine-readable export you can load into another system.

Rectification

Ask us to correct anything wrong. Most account fields you can edit yourself; email for the rest.

Erasure

Ask us to delete it, subject to the suppression and legal-record exceptions above, which we name rather than hide.

Restriction and objection

Ask us to stop a particular processing activity, including marketing to you, while a question is being worked out.

Complaint

Take it to your supervisory authority. Using this page first is faster, but the right does not depend on us.

Deletion has its own page with the exact wording to send and what happens after: request a data deletion.

Compliance posture, stated exactly

Blue Reacher's controls are mapped to the SOC 2 Trust Services Criteria for security, availability and confidentiality. The control mapping, the DPA and the subprocessor list are published in the trust centre, where a reviewer can read them without asking. No authority issues a GDPR certificate, whatever a vendor page implies.

HIPAA works differently and is worth separating out. No authority issues a HIPAA certificate, and the thing that creates the obligation is a signed business associate agreement. Blue Reacher signs one on Enterprise plans, on top of encryption in transit and at rest, least-privilege access with audit logging, retention limits and verified deletion.

What a security review gets, without asking twice: the data processing agreement published in full rather than sent after an NDA, the subprocessor list published rather than offered on request, fifteen pre-answered review questions on the trust centre, the full control mapping, and a completed security questionnaire in your own format on request.

Who to contact

Every request in this page goes to support@bluereacher.com, which is read by the people who run the platform. Blue Reacher is operated by Sagency International LLC, United States. Put EXPORT, DELETE or GDPR in the subject and we will know what to do with it. If you would rather see your options laid out by what you need, the contact page routes each one.

Frequently asked questions